#!/bin/bash
#功能函数
funcs=`which functions.sh`
if [ "$funcs" != "" ] ;then
    . $funcs
else
    funcs=`dirname $0`/functions.sh
    echo "$PWD"
    echo "funcs=$funcs"
    if [ "$funcs" != "" ] ;then
	. $funcs
    else
	exit
    fi
fi
# This is a script
# Edit by liwei
# establish a static firewall
# define const here
Open_ports="80 25 110 10 8224" # 自己机器对外开放的端口
Allow_ports="53 80 20 21" # internet的数据可以进入自己机器的端口

#init
IPTABLES="sudo iptables"
$IPTABLES -F
$IPTABLES -X
$IPTABLES -t nat -F
$IPTABLES -t nat -X
$IPTABLES --list
if [ "$1" = "init" ]; then
    return
fi


# The follow is comment , for make it better
# $IPTABLES -P INPUT DROP
$IPTABLES -A INPUT -i ! ppp0 -j ACCEPT
# define ruler so that some data can come in.
for Port in $Alow_ports; do
$IPTABLES -A INPUT -i ppp0 -p tcp --sport $Port -j ACCEPT
$IPTABLES -A INPUT -i ppp0 -p udp --sport $Port -j ACCEPT
done

for Port in $Open_ports ; do
$IPTABLES -A INPUT -i ppp0 -p tcp --dport $Port -j ACCEPT
$IPTABLES -A INPUT -i ppp0 -p udp --dport $Port -j ACCEPT
done
# This is the last ruler , it can make you firewall better
$IPTABLES -A INPUT -i ppp0 -p tcp -j REJECT -reject-with tcp-reset
$IPTABLES -A INPUT -i ppp0 -p udp -j REJECT -reject-with icmp-port-unreachable

